Master10
Computer & Digital Awareness20 Concepts & Facts

What Is OAuth and How Can a Website Access Another Service Without Knowing Your Password? GK Facts, Overview & Study Guide

Reviewed by the Master10 Editorial Board for accuracy, clarity and competitive-exam relevance.Editorial Policy
OAuth 2.0 is the open industry standard for delegated authorization, enabling third-party software applications to obtain limited access to protected user resources without disclosing confidential account passwords. Developed between 2006 and 2007 by Blaine Cook and Chris Messina, the protocol emerged to eliminate the dangerous anti-pattern of sharing master credentials with secondary web services. Formally standardized by the Internet Engineering Task Force in October 2012 as RFC 6749 and RFC 6750, the architecture operates like a hotel valet key. In this familiar analogy, a vehicle owner grants an attendant temporary permission to operate the car without providing physical access to the locked glovebox or trunk compartments. Consequently, users can permit desktop or mobile applications to synchronize data without compromising their primary login credentials.

The protocol defines four distinct architectural roles: the resource owner who controls the data, the client application requesting access, the authorization server that validates identity and issues tokens, and the resource server hosting protected APIs. Access is granted through short-lived access tokens, frequently structured as cryptographically signed JSON Web Tokens containing defined permission scopes. To counter token interception attacks on native and single-page applications, the Authorization Code Flow incorporates Proof Key for Code Exchange under RFC 7636. This cryptographic extension generates dynamic code verifiers and SHA-256 challenges, ensuring intercepted authorization codes cannot be exchanged for access tokens by malicious intermediaries. Long-lived refresh tokens permit clients to renew expired access tokens silently without prompting repeated user credential inputs.

A fundamental distinction exists between authorization and authentication within contemporary digital ecosystems. While OAuth 2.0 strictly governs authorization by regulating what data a client application can access, OpenID Connect introduces an identity layer published in 2014 to verify who the user is using structured ID tokens. In India, this federated authorization architecture forms the backbone of digital public infrastructure. The Reserve Bank of India’s Account Aggregator framework, the national DigiLocker repository, and the Ayushman Bharat Digital Mission rely on granular OAuth-based consent flows to share citizen financial, identity, and medical records securely without exposing underlying platform credentials. This consent-driven model maintains complete citizen privacy while facilitating interoperable data sharing across regulated institutional networks.

Key Concepts & Self-Assessment20 Key Facts

Review key OAuth 2.0 & Delegated Authorization: Access Tokens, PKCE, OpenID Connect & API Security exam facts and rate your mastery to track revision.

Progress: 0/20 Rated 0 Mastered 0 Review Later
#1
Blaine Cook and Chris Messina created OAuth in 2006 to eliminate insecure password sharing between independent third-party web applications.
#2
The Internet Engineering Task Force standardized OAuth 2.0 in October 2012 through RFC 6749, establishing delegated authorization rules across distributed software architectures.
#3
RFC 6750 specifies Bearer Token usage, granting possession-based API access rights without requiring additional cryptographic proofs from communicating client applications.
#4
The valet key analogy illustrates OAuth by granting third-party clients restricted access to specific resources without disclosing the master car key password.
#5
The resource owner represents the human end-user who exercises sovereign authority to grant or deny access to personal protected data assets.
#6
The client represents the third-party application requesting scoped authorization to interact with protected resources hosted on remote application programming interfaces.
#7
The authorization server authenticates the resource owner, gathers explicit scope consent, and issues cryptographically verifiable tokens to approved client applications.
#8
The resource server hosts protected user assets, validating incoming access tokens before responding to authorized API requests from external client systems.
#9
Scopes define explicit, granular permission boundaries that restrict third-party client capabilities to specific read, write, or administrative data actions.
#10
Access tokens act as short-lived credentials permitting resource servers to authorize incoming API calls without storing permanent user account login details.
#11
Refresh tokens possess extended lifespans, allowing client applications to obtain fresh access tokens securely without prompting repeated interactive user logins.
#12
JSON Web Tokens under RFC 7519 provide compact, self-contained token formats comprising encoded headers, claim payloads, and cryptographic digital signatures.
#13
Proof Key for Code Exchange under RFC 7636 prevents authorization code interception attacks on public mobile and single-page web applications.
#14
PKCE uses dynamic SHA-256 transformations to bind initial authorization requests to token exchanges, ensuring unauthorized interceptors cannot redeem captured codes.
#15
OAuth 2.0 strictly governs resource authorization, whereas OpenID Connect adds an identity verification layer delivering authenticated user identity via ID tokens.
#16
The OpenID Connect standard established in 2014 powers federated single sign-on mechanisms such as modern Google and Apple identity logins.
#17
India's Account Aggregator framework utilizes OAuth consent architecture to enable seamless, encrypted financial data exchanges between regulated financial institutions.
#18
DigiLocker relies on delegated authorization protocols to let external verification agencies access authenticated citizen documents without exposing master portal passwords.
#19
The Ayushman Bharat Digital Mission implements OAuth standards to ensure patient-directed medical record sharing across authorized healthcare providers securely.
#20
Cross-site request forgery risks during OAuth authorization flows are mitigated by enforcing unique, cryptographically random state parameter checks across redirects.

Subject Specialist Commentary

Analytical perspective & practical exam advice from the Master10 academic board

Educator's Insight
Computer awareness and cybersecurity examinations consistently test the conceptual divide between authorization and authentication. Aspirants must remember that OAuth 2.0 specifies what actions an authorized application can perform, whereas OpenID Connect determines who the user is. Questions frequently focus on the four protocol roles and the mitigation of code interception via PKCE. Recognizing the vulnerability of native mobile clients to redirect hijacking reinforces the necessity of dynamic SHA-256 verification challenges.
In state and national governance assessments, examiners frequently link OAuth architectures directly to India's digital public infrastructure including DigiLocker and Account Aggregators. Understanding how granular scopes protect citizen privacy without centralizing password disclosure represents a recurring evaluation theme across modern civil services curricula. To recall the primary security components during competitive tests, memorize the TOKEN mnemonic: Target resources, Owner authorization, Keyed signatures, Expiration limits, and Network confidentiality.

Related Knowledge Topics to Discover

Looking for more GK practice?

Explore 52,789+ questions across 65 General Knowledge categories.

Open Interactive Search